GP
Product
gpac
450
CVEs
0
On KEV
9.8
Max CVSS
4
New 30D
Severity mix
Critical 13High 147Medium 261Low 29
Watch
Add gpac to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-79522 | 6.5 | Sep 9 | An out-of-bounds read in the gf_dm_get_chunk_data function (src/utils/downloader.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS) via sending a crafted HTTP… Affected: 26.07.0 |
| CVE-2026-79513 | 6.5 | Sep 9 | A divide-by-zero vulnerability in the gf_dash_get_timeline_duration function (src/media_tools/dash_client.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS)… Affected: 26.07.0 |
| CVE-2026-79514 | 6.5 | Sep 9 | An out-of-bounds read in the gf_dm_data_received function (downloader.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS) via sending a crafted HTTP request Affected: 26.07.0 |
| CVE-2025-55639 | 6.5 | Jun 23 | GPAC MP4Box v2.4 was discovered to contain a NULL pointer dereference in the gf_isom_add_track_kind() function at isomedia/isom_write.c Affected: before 26.02.0 |
| CVE-2025-55642 | 6.5 | Jun 15 | GPAC MP4Box v2.4 was discovered to contain a floating point exception in the avidmx_process function (isomedia/isom_write.c) Affected: before 26.02.0 |
| CVE-2025-55658 | 6.5 | Jun 9 | GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gf_opus_parse_packet_header function (media_tools/av_parsers.c) Affected: 2.4 |
| CVE-2025-55659 | 6.5 | Jun 9 | A NULL pointer dereference in the ctts_box_write function (isomedia/box_code_base.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a… Affected: 2.4 |
| CVE-2025-70299 | 6.5 | Jan 15 | A heap overflow in the avi_parse_input_file() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted AVI file Affected: 2.4.0 |
| CVE-2022-3957 | 6.5 | Nov 11 | A vulnerability classified as problematic was found in GPAC Affected: before 2.2.0 |
| CVE-2018-21017 | 6.5 | Sep 16 | GPAC 0.7.1 has a memory leak in dinf_Read in isomedia/box_code_base.c Affected: 0.7.1 |
| CVE-2018-21016 | 6.5 | Sep 16 | audio_sample_entry_AddBox() at isomedia/box_code_base.c in GPAC 0.7.1 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via… Affected: 0.7.1 |
| CVE-2018-21015 | 6.5 | Sep 16 | AVC_DuplicateConfig() at isomedia/avc_ext.c in GPAC 0.7.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file Affected: 0.7.1 |
| CVE-2026-109827 | 6.3 | Oct 13 | GPAC AIT Parser ait.c gf_m2ts_decode_ait out-of-bounds write Affected: 26.07 |
| CVE-2026-108539 | 6.3 | Oct 11 | GPAC MP4Box filter_queue.c gf_fq_pop use after free Affected: 26.07 |
| CVE-2026-108538 | 6.3 | Oct 11 | GPAC MP4Box os_thread.c gf_mx_v use after free Affected: 26.07 |
| CVE-2026-103227 | 6.3 | Sep 30 | GPAC DASH Client dash_client.c gf_dash_resolve_url buffer overflow Affected: 26.07 |
| CVE-2026-91089 | 6.3 | Sep 15 | GPAC base_scenegraph.c gf_node_get_name_and_id use after free Affected: f1219cde |
| CVE-2026-91086 | 6.3 | Sep 15 | GPAC MPEG Video Reframer reframe_mpgvid.c mpgviddmx_process heap-based overflow Affected: f1219cde |
| CVE-2026-90794 | 6.3 | Sep 14 | GPAC MP4Box vrml_tools.c gf_sg_script_load use after free Affected: f1219cde |
| CVE-2026-90791 | 6.3 | Sep 14 | GPAC MP4Box base_scenegraph.c gf_node_unregister use after free Affected: f1219cde |
| CVE-2026-90687 | 6.3 | Sep 14 | GPAC MP4Box base_scenegraph.c gf_node_changed_internal use after free Affected: f1219cde |
| CVE-2026-4185 | 6.3 | Mar 15 | GPAC MP4Box swf_parse.c swf_def_bits_jpeg stack-based overflow Affected: 2.5-DEV-rev2167-gcc9d617c0-master |
| CVE-2024-28319 | 6.2 | Mar 15 | gpac 2.3-DEV-rev921-g422b78ecf-master was discovered to contain an out of boundary read vulnerability via gf_dash_setup_period media_tools/dash_client.c:6374 Affected: 2.3-dev-rev921-g422b78ecf-master |
| CVE-2025-60465 | 6.1 | Jun 25 | A use-after-free in the gf_filter_pid_inst_swap function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via… Affected: before 26.02.0 |
| CVE-2025-60468 | 5.5 | Jun 24 | GPAC Multimedia Open Source Project GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master is affected by: Buffer Overflow Affected: before 26.02.0 |
| CVE-2025-60471 | 5.5 | Jun 24 | A use-after-free in the gf_filter_pid_reconfigure_task_discard function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of… Affected: before 26.02.0 |
| CVE-2025-60473 | 5.5 | Jun 24 | A NULL pointer dereference in the gf_filter_in_parent_chain function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of… Affected: before 26.02.0 |
| CVE-2025-55650 | 5.5 | Jun 15 | A heap use-after-free in the gf_node_get_tag function (scenegraph/base_scenegraph.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a… Affected: before 26.02.0 |
| CVE-2025-55641 | 5.5 | Jun 15 | A NULL pointer dereference in the gf_isom_copy_sample_info function (isomedia/isom_write.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a… Affected: before 26.02.0 |
| CVE-2025-55643 | 5.5 | Jun 15 | A NULL pointer dereference in the TrackWriter handling component (filters/mux_isom.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a… Affected: before 26.02.0 |
| CVE-2025-55644 | 5.5 | Jun 15 | A heap use-after-free in the gf_node_get_tag function (scenegraph/base_scenegraph.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a… Affected: before 26.02.0 |
| CVE-2025-55661 | 5.5 | Jun 15 | A heap buffer overflow in the Opus audio stream parser component of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file Affected: before 26.02.0 |
| CVE-2025-55660 | 5.5 | Jun 15 | A stack overflow in the gf_opus_read_length function (media_tools/av_parsers.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4… Affected: before 26.02.0 |
| CVE-2025-55645 | 5.5 | Jun 15 | A heap buffer overflow in the gf_cenc_set_pssh function (isomedia/drm_sample.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4… Affected: before 26.02.0 |
| CVE-2025-55649 | 5.5 | Jun 15 | A NULL pointer dereference in the gf_media_map_esd function (media_tools/isom_tools.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a… Affected: before 26.02.0 |
| CVE-2025-55648 | 5.5 | Jun 15 | A heap buffer overflow in the gf_opus_parse_packet_header function (media_tools/av_parsers.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying… Affected: before 26.02.0 |
| CVE-2025-55652 | 5.5 | Jun 15 | A heap buffer overflow in the gf_isom_vp_config_new function (isomedia/avc_ext.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted… Affected: before 26.02.0 |
| CVE-2025-55647 | 5.5 | Jun 15 | An Out-of-Memory in the mp4_mux_cenc_insert_pssh function (filters/mux_isom.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4… Affected: before 26.02.0 |
| CVE-2025-55663 | 5.5 | Jun 15 | A segmentation violation in the Track_SetStreamDescriptor function (isomedia/track.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a… Affected: before 26.02.0 |
| CVE-2025-55651 | 5.5 | Jun 9 | A NULL pointer dereference in the gf_isom_get_user_data_count function (isomedia/isom_read.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying… Affected: 2.4 |
| CVE-2026-9572 | 5.5 | May 26 | GPAC MP4Box media.c Media_GetSample memory leak Affected: 2.0; 2.1; 2.2; 2.3; 2.4.0 |
| CVE-2026-8124 | 5.5 | May 8 | GPAC box_code_base.c sidx_box_read allocation of resources Affected: 26.02 |
| CVE-2026-39103 | 5.5 | May 5 | Buffer Overflow vulnerability in GPAC before commit v391dc7f4d234988ea0bc3cc294eb725eddf8f702 allows an attacker to cause a denial of service via the… Affected: before 2026-04-01 |
| CVE-2025-70305 | 5.5 | Jan 15 | A stack overflow in the dmx_saf function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted .saf file Affected: 2.4.0 |
| CVE-2025-70302 | 5.5 | Jan 15 | A heap overflow in the ghi_dmx_declare_opid_bin() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted input Affected: 2.4.0 |
| CVE-2025-70303 | 5.5 | Jan 15 | A heap overflow in the uncv_parse_config() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file Affected: 2.4.0 |
| CVE-2025-70310 | 5.5 | Jan 15 | A heap overflow in the vorbis_to_intern() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted .ogg file Affected: 2.4.0 |
| CVE-2025-70309 | 5.5 | Jan 15 | A stack overflow in the pcmreframe_flush_packet function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted WAV file Affected: 2.4.0 |
| CVE-2024-57184 | 5.5 | Jan 24 | An issue was discovered in GPAC v0.8.0, as demonstrated by MP4Box Affected: 0.8.0 |
| CVE-2024-50665 | 5.5 | Jan 23 | gpac 2.4 contains a SEGV at src/isomedia/drm_sample.c:1562:96 in isom_cenc_get_sai_by_saiz_saio in MP4Box Affected: 2.4 |